In my experience many jobs in "risk management" (under which I'd file a large part of cybersecurity from an organisational perspective) are 'second career jobs'

In my experience many jobs in "risk management" (under which I'd file a large part of cybersecurity from an organisational perspective) are 'second career jobs'. You first need to have done the job yourself before you start learning how to properly comment, guide, influence and teach colleagues and teams. People are notoriously resistant to outside critique even when you are part of the same organisation and principally on the same boat. So I would advise companies to let medior to senior staff that are not management material but can lead by example to take on more risk management roles. So how to get into cybersecurity? Don't. Do what you like (programming, systems administration or even IT-procurement) and after a few years start transitioning to cybersecurity. An exception would be the hardcore whitehats but firms usually don't have those on board and rely on consulting. So programmer-consultant is another route. But you won't get hired without quite the demonstrated homework, so you'll need to love it.